CVE-2026-15414 in Subscriptions for WooCommerce Plugin
Summary
by MITRE • 08/01/2026
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in the Subscriptions for WooCommerce plugin represents a critical privilege escalation flaw affecting versions up to and including 2.0.0. This security weakness stems from inadequate input validation within the save_meta_boxes() function that handles membership plan metadata persistence. The core issue manifests when the plugin processes the _wps_plan_user_role membership plan meta field from $_POST data without implementing proper allowlisting mechanisms to prevent assignment of privileged roles. The validation measures currently in place consist merely of sanitize_key() and wp_roles()->is_role() checks, both of which permit 'administrator' as a valid role value, effectively bypassing any meaningful security controls.
The vulnerability exploitation is facilitated by the client-side only disabled attribute on the role dropdown UI element, which provides no actual protection against malicious manipulation. Attackers can easily circumvent this restriction using browser developer tools or direct POST requests to submit privileged roles. Additionally, the plugin's architecture presents further weaknesses through the wps_membership_plan custom post type registration with capability_type set to 'post'. This configuration means that any user possessing edit_post capabilities can satisfy the current_user_can('edit_post', $post_id) security check within save_meta_boxes(), thereby enabling unauthorized privilege escalation from Contributor level upward.
The operational impact of this vulnerability extends beyond simple access control bypass, as it enables attackers to gain full administrative privileges through legitimate membership acquisition processes. When the Pro companion plugin is active, it reads the stored _wps_plan_user_role meta value via get_post_meta() and executes add_role() during membership lifecycle events, directly implementing the malicious role assignment. This creates a complete privilege escalation chain where authenticated users can elevate their access level to administrator status by simply selecting the administrator role when creating membership plans.
Security controls for this vulnerability align with CWE-264, which addresses permissions, privileges, and access controls in software systems. The flaw demonstrates characteristics of CWE-352, Cross-Site Request Forgery, through the client-side UI bypass mechanisms, while also representing a classic privilege escalation vector that maps to several ATT&CK techniques including privilege escalation via process injection and defense evasion through modification of system processes. The vulnerability requires minimal technical expertise to exploit, as it leverages existing WordPress capabilities and does not require complex attack vectors or specialized tools beyond basic browser manipulation.
Mitigation strategies should focus on implementing strict input validation with comprehensive allowlists that explicitly exclude privileged roles such as administrator, editor, and other high-privilege levels. The plugin must enforce server-side validation that cannot be bypassed by client-side controls, requiring a robust role validation mechanism that rejects any attempt to assign administrative capabilities through membership plan configuration. Additionally, the custom post type capability registration should be reconfigured to require specific administrative privileges rather than defaulting to post-level permissions, ensuring that only authorized administrators can modify membership plan configurations. The Pro plugin component must also implement additional validation layers to prevent execution of add_role() calls based on potentially malicious metadata values, requiring explicit confirmation and logging of all role assignment operations for audit purposes.